CVE-2015-5720
MediumCVSS 6.1Exploitation Probability (EPSS)
Elevated risk68th percentile - higher than 68% of all known CVEs
Summary
Multiple cross-site scripting (XSS) vulnerabilities in the template-creation feature in Malware Information Sharing Platform (MISP) before version 2.3.90 allow remote attackers to inject arbitrary web scripts or HTML via vectors involving (1) add.ctp, (2) edit.ctp, and (3) ajaxification.js.
Risk Assessment
Attackers can exploit these vulnerabilities to perform XSS attacks, potentially leading to user data theft or session hijacking.
Recommendation
It is recommended to update MISP to version 2.3.90 or later to eliminate these vulnerabilities and implement additional security measures against XSS attacks.
Original NVD description (English source)
Multiple cross-site scripting (XSS) vulnerabilities in the template-creation feature in Malware Information Sharing Platform (MISP) before 2.3.90 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) add.ctp, (2) edit.ctp, and (3) ajaxification.js.